Company data feels like business data, and most of it is. The founder column is the exception, and an email address constructed from a pattern does not escape that by never having been published. This page sets out what the texts say and what the two company-data Actors do about it.
Is a founder's work email personal data?
Article 4(1) GDPR defines personal data as "any information relating to an identified or identifiable natural person", and names a name as an example of an identifier. A founder's name, bio, LinkedIn URL and work address all relate to an identified person. That the address sits on a company domain, or that the bio was written for a public directory, does not change the definition.
The company-level columns are different. A domain, a batch, a team size or the fact that a company writes first.last@ describe a company, which is why the pattern finder's default row carries those and nothing about individuals.
An inferred address is still personal data
A pattern applied to a name produces an address that relates to that person, whether it was observed or guessed. Low confidence makes it more likely to be wrong; it does not make it someone else's. The YC Actor's emailCandidate is that construction, and 91.1% of 80 sampled founders received one while only 6 of 80 companies had evidence behind the pattern — the layers are described in what is stated and what is inferred.
GDPR: lawful basis, notice and objection
Three articles carry most of the weight for outreach built on this data:
| Article | What it requires |
|---|---|
| Art. 6 | A lawful basis for processing. For prospecting this is usually argued as legitimate interests under 6(1)(f), which applies "except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject". |
| Art. 14 | Notice to a person whose data was not obtained from them — within a reasonable period and at most one month, or at the latest at the first communication when the data is used to contact them. |
| Art. 21 | A right to object at any time to processing for direct marketing; once exercised, the data "shall no longer be processed for such purposes". |
The Article 14 duty is the one scraped datasets most often skip, and the same reading applied to classified-ad sellers is in GDPR and personal data in classifieds.
CCPA: no business-to-business exemption
The California Attorney General's CCPA page states that the exemptions for employment-related personal information and for personal information reflecting business-to-business transactions "expired on December 31, 2022". A Californian founder's work contact is therefore not carved out because the purpose is B2B. The same page describes the publicly available exclusion as information from federal, state or local government records, among certain other types — a startup directory is not a government record — and lists the rights to know, to delete and to opt out of sale or sharing. It also notes that the CCPA applies to data brokers.
What the two Actors do by default
| Default | YC Scraper | Email Pattern Finder |
|---|---|---|
| EU, EEA, UK and Swiss individuals | Withheld unless includeEuPersons; 66 of 675 sampled founders | No individual addresses by default for anyone |
| Personal-domain addresses | Removed everywhere unless includePersonalEmails | Counted, never listed unless includePersonalEmails |
| Constructed addresses | One per founder, labelled inferred or not, with confidence | Only for names supplied in knownPeople |
| Mailbox verification | None; MX only | None; MX only |
Both inputs say plainly where responsibility moves: enabling includeEuPersons makes the user responsible for a lawful basis under the GDPR, and the evidence and personal-email switches are to be enabled "only if you have a lawful basis". The defaults are described in context on the guides for the YC directory and GitHub email formats.
What the platforms' own terms add
Data protection law is not the only text in play. Y Combinator's Site Terms of Use prohibit harvesting "email addresses or other contact information of other users from the Site" to send unsolicited email, alongside a general prohibition on scraping. GitHub's Acceptable Use Policies prohibit using its information for spamming, including unsolicited email and selling personal information to recruiters, headhunters and job boards. Those are contractual terms rather than statutes, and they bind the person using the site.
One Actor in this catalogue resolves the question by not collecting people at all — the startup data the Wellfound Actor will not collect. These two collect founders and patterns, label what is inferred, and withhold by default where the exposure is highest. Which approach fits a use is a decision for whoever runs it.
